Full system takeover of Oracle Commerce Guided Search / Experience Manager 11.4.0 is possible by a remote, unauthenticated attacker reaching the Content Acquisition System (CAS) over HTTP, per Oracle's August 2026 Critical Patch Update. Successful exploitation yields complete loss of confidentiality, integrity, and availability and, because of a CVSS scope change, can significantly impact additional connected products beyond the vulnerable component itself. Oracle rates the flaw 9.0 but explicitly marks it difficult to exploit (AC:H); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full product takeover in Oracle WebCenter Sites (versions 12.2.1.4.0 and 14.1.2.0.0) allows a remote, unauthenticated attacker to compromise the platform over HTTP, with attacks capable of spilling beyond WebCenter Sites into other products due to a security scope change. Rated CVSS 9.0, the flaw yields complete confidentiality, integrity, and availability loss, though the high attack complexity (AC:H) means exploitation is non-trivial. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed via Oracle's August 2026 Critical Patch Update.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Unrestricted SHTML file upload in Joomla! CMS affects all versions from 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, impacting both the CMS and the Joomla! Framework Filesystem Package. The default blocklist of dangerous file types omitted SHTML files; on servers where SSI (Server Side Includes) is enabled and SHTML execution is active, a privileged user can upload a crafted SHTML file to achieve arbitrary server-side code execution. No public exploit code has been identified at time of analysis, though a vendor advisory has been published at the Joomla Security Centre.
OS command injection in the COMFAST CF-N1-S 2.6.0.1 router's CGI interface enables network-accessible, authenticated attackers to execute arbitrary operating system commands by manipulating the `ssid` parameter at the `/cgi-bin/mbox-config?method=SET§ion=ptest_ssid` endpoint. The underlying function `sub_44B438` passes unsanitized user input directly to a shell, resulting in full device compromise with scope impact extending to downstream network systems. A public proof-of-concept exploit has been published, classified under CWE-77 (Command Injection), and no vendor patch has been identified at time of analysis.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Remote code execution in n8n workflow automation platform (all versions prior to 1.123.64, 2.29.8, and 2.30.1) stems from a TOCTOU race condition in the Git node's clone operation, allowing any low-privileged authenticated user to achieve arbitrary JavaScript execution on the server. The attacker wins a race between path validation and the actual clone, replacing a legitimate directory with a symlink to plant a crafted repository in n8n's community node directory - which the platform loads and executes as trusted JavaScript on the next restart. Both self-hosted and cloud-hosted n8n instances are affected wherever authenticated users can create and run workflows containing the Git node; no public exploit or CISA KEV listing has been identified at time of analysis.
PHP Object Injection in TaxoPress versions up to and including 3.51.0 enables authenticated low-privileged WordPress users to inject malicious serialized PHP objects through the plugin's editor interface. When a suitable Property-Oriented Programming (POP) gadget chain is present in the target WordPress environment, this can escalate to full remote code execution, unauthorized file writes, or complete site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 High rating reflects the severe potential impact achievable with low authentication requirements.
Full system takeover of Oracle Financial Services Enterprise Case Management versions 8.0.8.2 and 8.1.2.11 is achievable by low-privileged, network-authenticated attackers targeting the Web UI component over HTTP. Oracle rates this as easily exploitable with a CVSS 3.1 score of 8.8, reflecting full confidentiality, integrity, and availability impact - consistent with complete application compromise. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Full system takeover is achievable in Oracle Call Center Technology (versions 12.2.3-12.2.15) by a low-privileged, network-authenticated attacker via HTTP, with no user interaction required. The vendor describes this as 'easily exploitable' and confirms full Confidentiality, Integrity, and Availability compromise - consistent with a CVSS 8.8 High rating and system takeover outcome. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and minimal privilege threshold lower the bar for exploitation significantly. Notably, the vulnerability tag 'Information Disclosure' understates the confirmed impact scope, which extends to full takeover.
Full takeover of Oracle Customers Online (E-Business Suite component) is achievable by any low-privileged authenticated user over HTTP, across versions 12.2.3 through 12.2.15. The Customer Tab component contains a flaw that, when exploited, yields complete confidentiality, integrity, and availability compromise - Oracle's own description uses the word 'takeover.' No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad authentication baseline (any portal account qualifies) make this a critical patching priority for Oracle EBS deployments.
Full system takeover is achievable in Oracle Enterprise Manager for Systems Infrastructure (versions 13.5 and 24.1) via the Storage Server Management component, exploitable by any low-privileged attacker with HTTP network access. The CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impact confirms complete compromise of the affected OEM instance - not merely information disclosure despite the 'Information Disclosure' tag in the source intelligence. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis, though Oracle's opaque CPU advisory format historically delays exploit development rather than preventing it.
Full takeover of Oracle Teleservice (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged attacker with network access via HTTP, exploiting a flaw in the Service Request Form component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms that exploitation is straightforward - no elevated privileges, no user interaction, and no complex preconditions beyond a valid low-privilege account. Oracle's own advisory characterizes the outcome as complete product takeover, implying full loss of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full takeover of Oracle Sales Foundation (E-Business Suite 12.2.3-12.2.15) is achievable by a low-privileged network attacker via HTTP, targeting the Security API component. The vulnerability is rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, indicating the attacker can gain complete control of the affected application. No public exploit or CISA KEV listing has been identified at time of analysis, though Oracle's classification as 'easily exploitable' elevates urgency for patching.
Full system compromise of Oracle Hyperion Calculation Manager 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with the Security component identified as the vulnerable surface. The CVSS 3.1 score of 8.8 reflects high impacts across confidentiality, integrity, and availability, consistent with Oracle's own characterization of complete product 'takeover.' No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the low attack complexity and minimal privilege requirements make this a credible near-term exploitation target.
Oracle Scripting versions 12.2.3 through 12.2.15, as part of Oracle E-Business Suite, exposes an easily exploitable flaw in its Internal Operations component that enables a low-privileged network attacker to achieve full system takeover over HTTP. The vulnerability scores CVSS 3.1 8.8, reflecting High impacts across all three pillars - Confidentiality, Integrity, and Availability - with low attack complexity and no user interaction required. No public exploit has been identified at time of analysis, but the minimal authentication barrier and network accessibility make this a high-urgency remediation target for organizations running Oracle EBS.
Full system takeover in Oracle Siebel CRM's Marketing component is achievable by low-privileged authenticated attackers over HTTP across all versions 17.0 through 26.6. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects low attack complexity with no user interaction required, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the straightforward exploitation conditions and full-triad impact make this a high-priority patch target for any organization running exposed Siebel Marketing instances.
Full takeover of Oracle WebCenter Portal is achievable by a low-privileged network attacker targeting the Composer component via Java RMI in versions 12.2.1.4.0 and 14.1.2.0.0. Oracle describes the vulnerability as 'easily exploitable,' with the CVSS 3.1 score of 8.8 reflecting complete Confidentiality, Integrity, and Availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and this CVE has not appeared in the CISA Known Exploited Vulnerabilities catalog, though it is disclosed as part of Oracle's Critical Patch Update for August 2026.
Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.
Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.
Full takeover of Oracle Agile PLM MCAD Connector 3.6 is achievable by a low-privileged network attacker targeting the CAX Client component over HTTP. Oracle's own advisory characterizes this as 'easily exploitable,' consistent with the CVSS vector showing no attack complexity and no user interaction required. No public exploit code or CISA KEV listing exists at time of analysis, but the combination of high-impact metrics and Oracle's 'easily exploitable' classification makes this a serious priority for affected Supply Chain environments.
Full system takeover of Oracle Business Intelligence Enterprise Edition 12.2.1.4.0 is achievable by any low-privileged authenticated user over HTTP, with no user interaction required. The Platform Security component flaw yields complete confidentiality, integrity, and availability compromise as described in Oracle's August 2026 Critical Security Patch Update. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network accessibility make this a high-priority remediation target for organizations running OBIEE 12.2.1.4.0.
Oracle Agile PLM 9.3.6 Application Server is susceptible to complete system takeover by a low-privileged attacker operating over HTTP, with no user interaction required. The CVSS 3.1 score of 8.8 reflects full confidentiality, integrity, and availability impact, consistent with Oracle's description of total compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack path makes this a credible priority for any organization running the affected version.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by any low-privileged attacker with network HTTP access, requiring no user interaction. The vulnerability resides in the Installation and Configuration component and yields complete compromise across confidentiality, integrity, and availability - Oracle's own advisory characterizes the outcome as a full product takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and low privilege bar make this a credible, high-priority remediation target for any organization running the affected release.
Full system takeover in Oracle Siebel CRM Deployment's Server Infrastructure component is achievable by any low-privileged attacker with network HTTP access, affecting versions 17.0 through 26.6. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation is straightforward - no elevated privileges, no user interaction, and low complexity - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation makes this a high-priority patching target for organizations running affected Siebel deployments.
Full takeover of Oracle Purchasing within Oracle E-Business Suite is achievable by any low-privileged, network-authenticated attacker exploiting this unspecified flaw in versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms exploitation requires no special conditions beyond a valid low-privilege account and HTTP access, with resulting impacts across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and full-impact triad make this a credible priority for any Oracle EBS deployment.
Full system takeover of Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged network attacker via TCP, with no user interaction required. The vulnerability resides in the Security component and results in complete compromise of confidentiality, integrity, and availability upon successful exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege bar make this a credible lateral-movement risk in enterprise financial environments.
Full system takeover is achievable in Oracle Hyperion Financial Management 11.2.25.0.000 through a flaw in its Security component, exploitable over HTTP by any low-privileged attacker with network access and no required user interaction. The CVSS 3.1 score of 8.8 reflects complete high-impact compromise of confidentiality, integrity, and availability. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Full system takeover is possible in Oracle Hyperion Financial Management 11.2.25.0.000 through the Security component, exploitable via SQL by a low-privileged network attacker with no user interaction required. Oracle classifies this as 'easily exploitable,' resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and full-takeover impact elevate real-world risk for any organization running the affected version.
Full system takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by low-privileged authenticated attackers over HTTP, with no interaction required beyond initial access. The vulnerability resides in the Access and Security component and results in complete compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and broad network accessibility make this a credible internal threat vector for any organization running the affected version.
Full takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is achievable by a low-privileged network attacker via HTTP, with confirmed impacts across confidentiality, integrity, and availability. The flaw resides in the Access and Security component, pointing to an authorization defect - likely privilege escalation or access control bypass - that allows any authenticated user to compromise the entire application. No public exploit has been identified at time of analysis, but the CVSS 8.8 score, low attack complexity, and Oracle's 'takeover' impact language make this a high-priority remediation target for organizations running financial master data management environments.
Full takeover of Oracle Application Testing Suite 13.3.0.1 is achievable by any low-privileged attacker holding the 'Load Testing for Web Apps' role via a network-accessible HTTPS vector. Oracle's own advisory classifies this as 'easily exploitable,' with complete confidentiality, integrity, and availability impact resulting in system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low complexity and broad CIA impact make this a credible priority for affected deployments.
Full system takeover in Oracle Hyperion Financial Management 11.2.25.0.000 is achievable by a low-privileged, network-authenticated attacker via the SQL interface targeting the Security component, with successful exploitation yielding complete confidentiality, integrity, and availability compromise. The CVSS 3.1 score of 8.8 reflects low attack complexity and no user interaction required, making exploitation straightforward for any attacker holding valid low-level credentials. No public exploit code has been identified and no CISA KEV listing is present at time of analysis, though the low barrier to exploitation warrants urgent patching for organizations running this version.
SQL-based network exploitation of Oracle Hyperion Financial Management 11.2.25.0.000 allows a low-privileged authenticated attacker to fully compromise the application, achieving complete confidentiality, integrity, and availability impact. The vulnerability resides in the Security component and is exploitable with low attack complexity and no user interaction required, making it a reliable attack path for any threat actor holding valid credentials. No public exploit code or active exploitation has been identified at time of analysis.
Full takeover of Oracle Risk Management (E-Business Suite versions 12.2.3-12.2.15) is achievable by any low-privileged authenticated user over HTTP, with no interaction from other parties required. The CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes this a high-priority patch target for Oracle EBS deployments.
Full takeover of Oracle Hyperion Financial Reporting 11.2.25.0.000 is achievable by any low-privileged network attacker communicating via HTTPS, with complete confidentiality, integrity, and availability impact confirmed by a CVSS 3.1 score of 8.8. The vulnerability resides in the Server component and requires only minimal authenticated access, presenting a low barrier for insider threat or compromised-credential scenarios. Oracle formally disclosed and addressed this issue in its August 2026 Critical Security Patch Update; no public exploit code or CISA KEV listing has been identified at time of analysis.
Full system takeover in Oracle Essbase 21.8.1.0.0 is achievable by any low-privileged authenticated user with network access via HTTP, targeting the Calculator component. The CVSS 3.1 score of 8.8 reflects complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), consistent with Oracle's own classification of this as 'easily exploitable.' No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity and network vector make this a credible and accessible exploitation path for any valid account holder.
Full takeover of Oracle General Ledger (E-Business Suite versions 12.2.3-12.2.15) is achievable by a low-privileged, network-accessible attacker via HTTP, requiring no user interaction and minimal exploitation complexity. The vulnerability resides in the Internal Operations component and results in complete compromise of confidentiality, integrity, and availability of the General Ledger application. No public exploit code or active exploitation has been identified at the time of analysis, but the vendor's own 'easily exploitable' characterization combined with the broad affected version range makes this a high-priority patch for all Oracle EBS deployments.
Full system takeover of Oracle Reports Developer 12.2.1.19.0 is achievable by any low-privileged authenticated user with HTTP network access, exploiting a flaw in the Security and Authentication component of Oracle Fusion Middleware. Oracle classifies this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete confidentiality, integrity, and availability impact - effectively equivalent to administrative compromise of the affected instance. No public exploit code or active exploitation has been identified at time of analysis, but the low attack barrier significantly narrows the defender's window.
Full system takeover of Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is achievable by a low-privileged attacker over HTTP, exploiting the Common Events component with no user interaction required. The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact, consistent with the vendor's own characterization of the outcome as a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and minimal privilege requirement make this a credible threat for any organization running the affected version.
Oracle Flow Manufacturing versions 12.2.3 through 12.2.15, a component of Oracle E-Business Suite, contains a vulnerability in its Internal Operations component that allows a low-privileged, network-authenticated attacker to fully compromise the system via HTTP with no user interaction required. The vendor characterizes this as 'easily exploitable,' and the CVSS 3.1 score of 8.8 reflects complete loss of confidentiality, integrity, and availability - constituting a full product takeover rather than the narrower 'Information Disclosure' tag in the intelligence metadata would suggest. No public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Full application takeover in Oracle Siebel CRM Cloud Applications (versions 22.3-26.6) is achievable by any low-privileged, network-accessible attacker via HTTP against the Siebel Cloud Manager component, with no user interaction required. Oracle classifies this as 'easily exploitable' and the CVSS vector confirms high impact across confidentiality, integrity, and availability - consistent with a complete system compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad version range across four years of releases materially raises real-world risk for unpatched enterprise deployments.
Siebel Cloud Manager in Oracle Siebel CRM Cloud Applications exposes a network-accessible, low-complexity attack path that allows any low-privileged authenticated user to fully take over the application via HTTP. Affected versions span 22.3 through 26.6, a multi-year range covering a substantial portion of the deployed base. No public exploit has been identified at time of analysis; however, Oracle's own characterization of this as 'easily exploitable' and the complete C/I/A impact make this a high-priority remediation target from the August 2026 Critical Patch Update.
Full takeover of Oracle U.S. Federal Financials (versions 12.2.3 through 12.2.15) is achievable by a low-privileged attacker over HTTP, with successful exploitation resulting in complete compromise of confidentiality, integrity, and availability. The Internal Operations component within Oracle E-Business Suite exposes this attack surface to any authenticated network user, requiring no user interaction and no elevated permissions beyond a basic account. No public exploit or CISA KEV listing has been identified at time of analysis, though the low attack complexity and high impact make this a priority patching target for affected federal agencies.
Full platform takeover of Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) is achievable by any low-privileged attacker with HTTP access to the Application Config Console component. The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H confirms low attack complexity, no user interaction, and full confidentiality, integrity, and availability impact - directly corroborated by Oracle's own characterization of the outcome as complete platform compromise. No public exploit has been identified at time of analysis, but Oracle has released a fix via the August 2026 Critical Security Patch Update.
Full takeover of Oracle Identity Manager (OIM) is achievable by any low-privileged, network-authenticated attacker exploiting a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Both actively supported versions - 12.2.1.4.0 and 14.1.2.1.0 - are affected, and the attack requires only HTTP network access with minimal credentials, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact make this a high-priority patching target.
Full system takeover of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged attacker with network access over HTTP. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no user interaction required, classifying this as an easily exploitable, high-severity vulnerability within Oracle's Fusion Middleware portfolio. No public exploit has been identified at time of analysis, but Oracle's explicit use of 'takeover' language in the advisory indicates the potential for complete system compromise.
Full compromise of Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 is achievable by any low-privileged authenticated user with HTTP network access, requiring neither elevated rights nor user interaction. Oracle's own disclosure language characterizes this as 'easily exploitable,' and the resulting impact is described as complete system takeover - implying full loss of confidentiality, integrity, and availability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low attack barrier and critical business function of enterprise WCM platforms make this an immediate patching priority.
Full system takeover of Oracle WebCenter Sites 12.2.1.4.0 and 14.1.2.0.0 is achievable by a low-privileged authenticated attacker over HTTP, with Oracle's own advisory characterizing the flaw as 'easily exploitable.' Successful exploitation yields complete compromise of confidentiality, integrity, and availability of the affected WebCenter Sites instance. No public exploit code or active exploitation has been confirmed at time of analysis, though the low attack complexity and severity of impact make this a high-priority remediation target.